The Definitive Chronicle of Identity & Access Management
BREACH: Major healthcare provider confirms 2.3M patient records exposed via misconfigured SCIM endpoint
CVE-2026-31847: Critical RCE in FortiAuthenticator - CVSS 9.8 - Patch immediately
BREACH: European fintech platform leaks OAuth tokens affecting 890K users
A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution. "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue
Attackers used Hermes, an autonomous open source tool, in unrestricted "YOLO mode" to conduct espionage against Thailand's Ministry of Finance.
Researchers say JadePuffer is the first documented ransomware operation run end-to-end by an automated agent — here's what that means for IAM defenses.
Many banks still make MFA optional for customers, and that gap is costing account holders. Here's what IAM practitioners can take from it.
A flaw in Leantime's verifyState() method means OIDC login CSRF is trivially exploitable — attackers can fix sessions and hijack accounts.
The Eventer WordPress plugin stores password reset keys in plaintext, enabling full account takeover when chained with a SQL injection flaw.
The new directive requires all Government of Canada systems to implement FIDO2-compliant authentication, phasing out SMS-based MFA.
Misconfigured SCIM provisioning endpoint exposed patient identity data.
Exposed refresh tokens allowed unauthorized access to customer financial accounts.
LDAP injection attack exposed 340K employee records including AD credentials.
Federated SAML assertion replay attack affected 45 university systems.
Automated attack compromised 120K accounts using previously breached credentials.
Unauthenticated remote code execution via crafted RADIUS authentication packet.
Token validation flaw allows authentication bypass in specific OIDC flow configurations.
XML External Entity injection in SAML metadata parser allows SSRF.
Custom policy XML injection allows privilege escalation in B2C tenants.
Session token not rotated after authentication in specific broker flows.
Join thousands of IAM professionals getting the weekly Intelligence Brief every Monday morning.